"""Secret encryption exposed to plugins (SPEC §10.2 vault).

Heavy plugins (calendar/contacts) store third-party credentials — CalDAV/CardDAV
passwords, ICS tokens — in their own ``secret_ct bytea`` columns. They encrypt via
this facade so those secrets are protected at rest with the same envelope scheme as
core account credentials, without importing ``app.security`` directly.
"""

from __future__ import annotations

from app.security.crypto import decrypt_secret, encrypt_secret


class PluginVault:
    def encrypt(self, plaintext: bytes) -> bytes:
        """Envelope-encrypt ``plaintext`` for storage in a ``secret_ct`` column."""
        return encrypt_secret(plaintext)

    def decrypt(self, ciphertext: bytes) -> bytes:
        """Reverse :meth:`encrypt`. Raises on a wrong/rotated master key."""
        return decrypt_secret(ciphertext)